Confessions of a sysadmin

I found a virus on my network today…


Blog I would like to say that it has been a few days since my last malware infected computer. I have been dealing with a string of these lately, and I’ve had quite enough of them for now, thank you.

I would also like to say my network was the epitome of configuration perfection, with every system fully patched, and a team of network ninjas facing off against hired pirates in a never ending battle for security perfection. The truth, however, is less ideal. My network has some systems that can’t ever be patched, and others where IT can’t force automatic patches. Configuration errors will inevitably exist due to a combination of lack of time, lack of knowledge or prioritization of IT tasks.

According to the email of article topics in my inbox, this one is supposed to be about the importance of proper configuration and patch management. Instead of being able to stand atop an ivory tower and reveal to you the secrets of perfect network management, I am forced to humble myself before the entire internet with a confession:

I discovered the Conficker worm on my network today.

I am shamed by this because the infection was entirely preventable and all the more because this discovery occurred the day this very article was due. While I had a lovely sermon prepared in which I would discuss why proper configuration and patch management are so very important, I think that doing a post-mortem on exactly how I contracted these bugs will be both far more entertaining, and perhaps even a little enlightening.

I discovered the infection today on Windows 2000 systems running Service Pack 4. Each system serves as a network and command and control interface for a large piece of equipment (think the size of a small car).

The hardware they are running on is fairly old (they talk to their attached equipment via a truly ancient SCSI card) and the software is remarkably picky and brittle. If installed exactly as directed, the computers (and their attached equipment) run just fine. Install the wrong windows update or change the wrong setting and they will refuse to work.

As an added bonus, the hardware specifications on the provided kit is so exact that if you were to (for example) load an anti-malware scanner on the system then the performance decrease would very negatively affect the productivity of the unit. Any decrease in output capacity of these units simply will not be tolerated.

The more I delve into the situation the more I am convinced these systems were infected a while ago. We had a user who opened an infected attachment (Windows XP, and yes they had to be running as an administrator to get their work done). For the curious it was a pdf. This turned out to be Conficker, which in turn ate every vulnerable computer on the entire network in about 15 minutes flat, and a fun night was had by all.

After we had sent the initial conficker infection shrieking back into the void from which it arose, we ran around to every single computer on the network and checked them one at a time. We remoted into each one in turn, ticked them off against both our IT internal list of systems, DHCP and even a Languard scan. After a few hours of fighting this particular brushfire, we were satisfied the network was clean and went home. By the time we arrived the next day we were on to the next problem, and the infection was almost completely forgotten.

This is where I made a big mistake.

The systems I discovered as infected today were, at the time we started cleaning the network, simply turned off. At the end of every work day, when the staff who use that equipment are done with it, they shut it down. They must have been active when the initial infection took place, and were turned off by staff member leaving for the night after we booted everyone off the network.

What’s worse, I completely forgot that those systems had Windows computers in them. They were, as computers integrated into larger pieces of equipment, out of sight and thus out of mind. (Let that be a lesson to you all: computers are integrated into everything these days. Think really, really hard about what’s on your network before declaring it bug-free.)

Knowing how these systems got infected, let’s delve into how I could have prevented this from occurring. The first and most obvious problem is that of patch management. I have a Windows Server Update Services (WSUS) server on my network to distribute patches, and I am very fastidious about testing patches against existing software and releasing the updates as soon as possible.


Other stories you might like

  • DORA explorers see pandemic boost in numbers of 'elite' DevOps performers

    Or is it that they're just more inclined to complete surveys about themselves?

    A report from DORA, that's the Devops Research and Assessment sponsored by Google and other DevOps vendors, says 26 per cent of surveyed technology workers consider themselves "elite performers."

    DORA was founded in 2015 by DevOps specialists Nicole Forsgren, Jez Humble, and Gene Kim, and in late 2018 was absorbed by Google Cloud. Each year the gang, now led by Google's Dustin Smith, publishes an Accelerate State of DevOps report, co-sponsored by nine other DevOps outfits.

    The research is based on responses from "1,200 working professionals," we're told, with over half in organizations of 500 or more employees. The majority of respondents work in development, software engineering, DevOps, site reliability engineering, or management. Two out of five participants are said to have at least 16 years of IT experience.

    Continue reading
  • Senior IBMer hit with £290k demand from Big Blue in separate case as unfair dismissal claim rolls on

    High Court and Employment Tribunal cases to be heard soon

    A former IBM general manager who was posted to the United Arab Emirates is being sued by the company for £290,000 after filing an employment tribunal case claiming unfair dismissal.

    In its particulars of claim lodged on 10 February 2021 and recently made available by the court, Big Blue claimed that former Middle East GM Shamayun Miah should hand back two "special payments" because it sacked him within two years of paying him the cash lump sums.

    Miah was paid pre-tax sums of £175,000 on 1 January 2018 and a further £100,000 on 1 January 2019, according to IBM's High Court filing. IBM has claimed he is "liable" to repay a portion of each of payment, together totalling £145,750.

    Continue reading
  • If you're Intel, self-driving cars look an awful lot like PCs

    Hardware capabilities, latest feature updates? You'll get what you pay for

    Intel's vision of the computing architecture of autonomous vehicles is similar to that of PCs, with pricey models getting better hardware and the latest software, and cheaper self-driving cars getting the bare minimum.

    The segments of premium and mid-range cars will need extra compute and over-the-air update capabilities to enable increasing levels of autonomous driving, said Erez Dagan, executive vice president at Mobileye, Intel's self-driving car system division, speaking at the Evercore ISI Autotech & AI Forum this week.

    On the other hand, low-end vehicles will have basic equipment, sensors, and features as mandated or incentivized by regulations like the EU's General Safety Regulation, which focuses on improving driver safety.

    Continue reading
  • Researchers finger new APT group, FamousSparrow, for hotel attacks

    Espionage motive mooted in attacks which hit industry, government too

    Researchers at security specialist ESET claim to have found a shiny new advanced persistent threat (APT) group dubbed FamousSparrow - after discovering its custom backdoor, SparrowDoor, on hotels and government systems around the world.

    "FamousSparrow is currently the only user of a custom backdoor that we discovered in the investigation and called SparrowDoor," ESET researcher and co-author of the report Tahseen Bin Taj explained in a prepared statement. "The group also uses two custom versions of Mimikatz. The presence of any of these custom malicious tools could be used to connect incidents to FamousSparrow."

    The group can be traced back to 2019, the researchers claimed, though the attacks tracked in the report made use of the ProxyLogon vulnerability in Microsoft Exchange starting in March this year. Victims were spread around Europe, the Middle East, the Americas, Asia, and Africa - without a single one being discovered in the US, oddly.

    Continue reading
  • Is it a bird? Is it a plane? Nah, it's just Windows suffering from a bit of vertigo

    Up above the streets and houses, XP's flying high

    Bork!Bork!Bork! Windows XP continues to hang in there – quite literally – as the operating system does what it does best some 90 metres above the London's River Thames.

    The screen, spotted by Register reader Andy Jones while safely ensconced within the confines of an Emirates Air Line gondola, appears to be in something of a boot loop. It looks to be endlessly resetting as the UK capital city's cable car attraction grinds itself along the kilometre or so between the Greenwich Peninsula and the Royal Docks.

    Continue reading
  • How many Android containers can you fit on your VM?

    The Register speaks to Canonical about running the OS in the cloud

    Interview Developers targeting Android are spoiled for choice with their platforms.

    There are a variety of options available for running Android application development environments these days. Even Microsoft has promised that its upcoming Windows 11 will eventually be able to run the apps on the desktop and has long since supported the mobile OS via its Your Phone app, even while smothering its ailing Windows Phone with a cuddly Android pillow.

    For Canonical, however, Anbox remains a cloud product, according to Simon Fels, engineering manager and is therefore unlikely to feature in any desktop version of the company's Ubuntu distribution any time soon, although with September's announcement it will now cheerfully scale from the heights of the cloud down to a single Virtual Machine via the Appliance version.

    Continue reading
  • Infosys admits it still hasn't fully fixed Indian tax portal

    Deadline came and went, but over 750 'resources' are still hard at work

    Infosys has admitted it has missed the Indian government's deadline to fix the tax portal it built, but which has been a glitchy mess since its June 2021 launch.

    The portal was introduced to make filing taxes more efficient. It delivered the opposite – India's government was forced to extend filing deadlines amid user complaints that they found the portal impossible to use. The portal was even placed into "emergency maintenance" mode at one point, during which it was completely unavailable.

    Infosys was shamed by ministers and on August 22nd was given a September 15th deadline to fix the portal.

    Continue reading
  • Here's an idea: Verification for computer networks as well as chips and code

    What tools are available? What are the benefits? Let's find out

    Systems Approach In 1984, artificial intelligence was having a moment. There was enough optimism around it to inspire me to explore the role of AI in chip design for my undergraduate thesis, but there were also early signs that the optimism was unjustified.

    The term “AI winter” was coined the same year and came to pass a few years later. But it was my interest in AI that led me to Edinburgh University for my PhD, where my thesis advisor (who worked in the computer science department and took a dim view of the completely separate department of artificial intelligence) encouraged me to focus on the chip design side of my research rather than AI. That turned out to be good advice at least to the extent that I missed the bursting of the AI bubble of the 1980s.

    The outcome of all this was that I studied formal methods for hardware verification at a point in time where hardware description languages (HDLs) were just getting off the ground. These days, HDLs are a central part of chip design and formal verification of chip correctness has been used for about 20 years. I’m pretty sure my PhD had no impact on the industry – these changes were coming anyway.

    Continue reading
  • Imagine a fiber optic cable that can sense it's about to be dug up and send a warning

    Forget wiring cities with IoT devices – this could be how wide-scale sensing gets done

    Imagine an optic fiber that can sense the presence of a nearby jackhammer and warn its owner that it is in danger of being dug up, just in time to tell diggers not to sink another shaft. Next, imagine that an entire city's installed base of fiber could be turned into sensors that will make planners think twice before installing IoT devices.

    Next, stop imagining: the tech is real, already working, and was yesterday used to demonstrate the impact of an earthquake.

    As explained to The Register by Mark Englund, CEO of FiberSense, the company uses techniques derived from sonar to sense vibrations in fiber cables. FiberSense shoots lasers down the cables and observes the backscatter as the long strands of glass react to their environment.

    Continue reading
  • Unable to test every tourist and unable to turn them away, Greece used ML to pick visitors for COVID-19 checks

    Inside the software built to figure out groups of potentially infected, asymptomatic passengers

    Faced with limited resources in a pandemic, Greece turned to machine-learning software to decide which sorts of travelers to test for COVID-19 as they arrived in the country.

    The system in question used reinforcement learning, specifically multi-armed bandit algorithms, to identify which potentially infected, asymptomatic passengers were worth testing and putting into quarantine if necessary. It also was able to produce up-to-date statistics on infections for officials to analyze, such as early signs of the emergence of COVID-19 hot spots abroad, we're told.

    Nicknamed Eva, the software was put to use at all 40 of Greece's entry points from August 6 to November 1 last year. Incoming travelers were asked to fill out a questionnaire detailing the country and region they were coming from as well as their age and gender. Based on these characteristics, Eva selected whether they should be tested for COVID-19 upon arrival. At its peak, Eva was apparently processing between roughly 30,000 and 55,000 forms a day, each form representing a household, and about 10 to 20 per cent of households were tested.

    Continue reading
  • Angry birds ground some Google Wing drones in Australia

    Between COVID and corvids, locked-down Aussies can't catch a break - or a coffee lowered from the treetops

    Some of Google parent company Alphabet's Wing delivery drones have been grounded by angry Australian birds.

    As reported by the Australian Broadcasting Corporation, and filmed by residents of Canberra, ravens have attacked at least one of Wing's drones during a delivery run.

    Canberra, Australia's capital city, is currently in COVID-caused lockdown. It's also coming into spring – a time when local birds become a menace in the leafy city. Magpies are a particular hazard because they swoop passers-by who they deem to be threateningly close to their nests and the eggs they contain. Being swooped is very little fun – magpies dive in, often from a blind spot, snapping their sharp beaks, and can return two or three times on a single run. Swooping is intimidating for walkers, and downright dangerous for cyclists.

    Continue reading

Biting the hand that feeds IT © 1998–2021